Privacy Policy

1. Overview

JoinNow FZCO ("JoinNow", "we", "us", or "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share information about you when you use our platform at joinnow.io and any related services (collectively, the "Platform").

JoinNow FZCO acts as the data controller within the meaning of the EU General Data Protection Regulation (GDPR). This means we determine the purposes and means of processing your personal data.

By using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Platform.

2. Data We Collect

We collect personal data that you provide to us directly, as well as data generated through your use of the Platform. This includes:

Talent profile data:

• Full name, professional title, and profile photograph
• Work history, including details of projects undertaken for DACH-based companies
• Technical skills, certifications, and portfolio links
• CV or résumé and any other documents you upload (for example certificates or work samples)
• Language proficiencies and communication preferences
• Preferred engagement type (employment, independent contracting, relocation)
• Rate expectations and availability
• Referral submissions: a candidate's name, contact details, and skills provided to us by the person referring them

Contact and enquiry data:

• Email address and phone number
• Company name, where you provide one
• Country of residence and time zone
• The topic you select for an enquiry, your preferred language for our reply, and the content of the message you send us through our contact, application, or referral forms

Usage and technical data:

• IP address, browser type, and device information
• Pages visited, session duration, and navigation paths
• Cookies and similar tracking technologies (see Section 5)
• Communication logs between talent and our team

We do not ask for special categories of personal data (e.g., racial or ethnic origin, health data, biometric data), and none of our forms requests them. A CV or other document you upload is free-form, however, so it may contain such information — a photograph, a date of birth, or family or health details, for example. We do not require it and ask you not to include it. Where you nevertheless provide such information, we process it on the basis of your explicit consent (Art. 9(2)(a) GDPR), or where it is strictly required by applicable law.

3. How We Use Your Data

We process your personal data on the following legal bases and for the following purposes:

Performance of a contract (Art. 6(1)(b) GDPR):

• Creating and managing your account on the Platform
• Matching talent profiles with relevant opportunities at DACH companies
• AI-assisted screening of talent profiles: we use automated tools to review the profile and documents you submit — checking the DACH project history you state, assessing your technical skills, and evaluating your written communication — so that profiles can be ranked and shortlisted for relevant opportunities. This is profiling within the meaning of Art. 4(4) GDPR. A member of our team reviews the results and takes every shortlisting and placement decision, so no decision about you is based solely on automated processing. You can ask us to explain or re-review an assessment at privacy@joinnow.io
• Facilitating introductions, interviews, and placement processes
• Processing payments and issuing invoices where applicable
• Receiving and answering enquiries you submit through our contact form — including the topic you select, your preferred language, and the content of your message — and following them up where they concern a possible engagement; where an enquiry does not, we handle it on the basis of our legitimate interest in responding to messages addressed to us (Art. 6(1)(f) GDPR)

Legitimate interests (Art. 6(1)(f) GDPR):

• Improving and personalising the Platform experience
• Sending relevant platform updates, role alerts, and service communications
• Fraud prevention and platform security
• Internal analytics and performance measurement

Legal obligations (Art. 6(1)(c) GDPR):

• Retaining records for tax, accounting, and regulatory compliance purposes
• Documenting the cookie consent you give or decline, so that we can demonstrate it (Art. 7(1) GDPR); see Section 5
• Responding to lawful requests from public authorities

Consent (Art. 6(1)(a) GDPR):

• Sending marketing communications (where you have opted in)
• Placing non-essential cookies (as described in Section 5)

4. Data Sharing

We share your personal data only in the circumstances described below. We do not sell your personal data to third parties.

With DACH client companies:

When presenting talent to prospective clients, profiles are initially shared in anonymised form — omitting full name and contact details — to allow companies to assess fit. Full profile details are only disclosed after you have been informed and have not objected, or where you have actively expressed interest in a specific opportunity.

With compliance and infrastructure partners:

• Our partner company in Bangalore, India, which employs or contracts talent for engagements (contractually bound to confidentiality and data protection obligations)
• Cloud infrastructure providers — Netlify, Inc. (hosting and form handling) and Cloudflare, Inc. (authoritative DNS only), both described in section 5 (data processing agreements in place)
• Google Ireland Limited, whose Google Workspace service carries our business email — so anything you write to hello@joinnow.io or privacy@joinnow.io is processed there
• Meta Platforms Ireland Limited, if you choose to contact us on WhatsApp Business using the number published in our footer and imprint. Meta then processes your phone number, your profile name and the content of your messages under its own terms, and data may be transferred to the United States. Use email or the contact form instead if you would rather not involve Meta.
• Payment processors and accounting platforms for invoicing and payroll
• Background verification partners for credential checks (only with your prior consent)
• Legal and tax advisors bound by professional confidentiality obligations

All third-party processors with whom we share data are bound by data processing agreements compliant with Art. 28 GDPR. JoinNow FZCO is established in the United Arab Emirates and works with a partner company in Bangalore, India, so your personal data is processed outside the European Economic Area. Neither the United Arab Emirates nor India is covered by a European Commission adequacy decision. These transfers are therefore made on the basis of the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) — concluded with our Bangalore delivery partner and covering the processing carried out by JoinNow FZCO in Dubai — supplemented by contractual confidentiality obligations and technical and organisational security measures. You may request a copy of the clauses that apply to a specific recipient by writing to privacy@joinnow.io.

5. Cookies, Analytics & Third-Party Services

We use cookies and third-party services to operate, secure, and improve the Platform. Non-essential cookies and analytics or marketing tags are only loaded after you have given consent via our cookie banner. Until you consent, storage and measurement are set to "denied" by default (Google Consent Mode v2). You can change or withdraw your choices at any time through the cookie settings on the site. The one exception is our own cookieless visitor statistics, described under "Plausible Analytics" below: they store nothing on your device and therefore need no consent.

Our consent banner, your stored choice & withdrawal:

The banner is our own — no third-party consent service is involved — and appears on your first visit, asking you to choose between "Accept all" and "Necessary only". Your choice is not kept in a cookie but in your browser's local storage, under the key jn-consent. That entry holds nothing but the banner version, whether you consented, and the time of your choice; it stays on your device and is not sent to our servers with your requests. Storing the decision is strictly necessary in order to honour it, so it is placed without consent under Section 25(2) TDDDG and Art. 5(3) of the ePrivacy Directive. The entry is valid for 12 months — after that the banner asks again, so that your consent stays a current decision. You can change or withdraw your choice at any time, without giving reasons and as easily as you gave it, through the "Cookie Settings" link in the footer of every page, which reopens the banner (Art. 7(3) GDPR). A withdrawal applies from the next page load onwards and does not affect the lawfulness of the processing carried out before it. Clearing your browser storage has the same effect as never having made a choice: the banner returns and nothing non-essential loads until you consent again.

Proof-of-consent log:

We must be able to demonstrate that you gave consent (Art. 7(1) GDPR). Each time you accept or decline, your browser therefore sends a single record to our own endpoint at /api/consent, where it is stored: the date and time, your choice, the banner version, the language version of the site, the page you were on, a shortened IP address (the final block of an IPv4 address is set to zero, an IPv6 address is truncated after three blocks) and your browser's user-agent string, cut off after 200 characters. Your full IP address is never stored, no identifier is set for this purpose, no cookie is involved, and the records are not used for analytics, profiling, or advertising. This processing rests on our legal obligation to document consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). The records are held for us by Netlify, Inc. in its Netlify Blobs storage, under the data processing agreement and Standard Contractual Clauses described below, and are retained as set out in Section 6.

Plausible Analytics (cookieless visitor statistics):

We count visits with Plausible Analytics, which we host ourselves on our own server at kp.joinnow.io. The measurement data therefore stays on our own infrastructure inside the EU, is not passed to any advertising network, and is not transferred to a third country. Plausible sets no cookie and writes nothing to your device; the only thing it reads from your browser is an opt-out flag that you can set yourself. It uses no cross-site identifier and cannot follow you to other websites. Your IP address is used solely to derive your country and is never stored: together with your browser's user-agent string and a salt that we rotate every day, it is turned into a hash that cannot be reversed, and once the salt is discarded a returning visitor can no longer be linked to the previous day. We record the page URL, the referring website, your country, coarse device, browser and operating-system categories, and whether you clicked a link to another site, downloaded a file, successfully submitted one of our forms, or landed on a page that does not exist. Because nothing is stored on or read from your device for this purpose, Section 25(1) TDDDG does not apply and no consent is required; the processing rests on our legitimate interest in understanding how our website is used (Art. 6(1)(f) GDPR). No profile of you is built and none of this data is combined with the enquiry, application or referral data you send us. You can object at any time under Art. 21(1) GDPR by writing to privacy@joinnow.io, and you can stop the measurement yourself with any content blocker.

Google Tag Manager:

We use Google Tag Manager, a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to manage and deploy the tags on our website. Google Tag Manager itself does not set cookies or collect personal data; it acts as a container that loads other tags (such as Google Analytics) only in accordance with the consent you have given. The tags it manages are described below.

Google Analytics:

We use Google Analytics, a web-analytics service provided by Google Ireland Limited, to understand how visitors use the Platform. Where you consent, Google Analytics sets cookies (e.g. _ga) and processes pseudonymous usage data — including a shortened IP address, device and browser information, pages visited, and session behaviour — to generate aggregated statistics. IP addresses are truncated within the EU before further processing. This processing is based on your consent (Art. 6(1)(a) GDPR). Data may be transferred to Google LLC in the United States; such transfers are safeguarded by the EU Standard Contractual Clauses and Google's participation in the EU–US Data Privacy Framework. You can prevent Google Analytics processing by declining analytics cookies in our banner, or by installing Google's browser opt-out add-on at tools.google.com/dlpage/gaoptout.

Microsoft Clarity (session analytics):

Where you consent, we use Microsoft Clarity, an analytics service provided by Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Clarity goes beyond page counts: it records how you interact with a page — mouse movement, scrolling, clicks and taps — and replays those interactions as a session recording, and aggregates them into heatmaps. It sets cookies (_clck/_clsk) to recognise a returning session. Text you type into form fields and the content of uploaded files are masked and are not recorded. This processing is based on your consent (Art. 6(1)(a) GDPR). Data may be transferred to Microsoft Corporation in the United States; such transfers are safeguarded by the EU Standard Contractual Clauses and Microsoft's participation in the EU–US Data Privacy Framework. Decline analytics cookies in our banner and Clarity does not load.

Microsoft Advertising (UET conversion tracking):

Where you consent, we use the Universal Event Tracking (UET) tag from Microsoft Advertising, also provided by Microsoft Ireland Operations Limited, to measure whether a visit that began with an advertisement led to an enquiry or application, and to build audiences for advertising. It sets cookies (_uetsid/_uetvid) to link those events to a visit. This processing is based on your consent (Art. 6(1)(a) GDPR). Data may be transferred to Microsoft Corporation in the United States on the basis of the EU Standard Contractual Clauses and the EU–US Data Privacy Framework. Decline marketing cookies in our banner and the UET tag does not load.

Cloudflare (authoritative DNS):

Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA) answers the DNS queries for our domain — the lookup that turns joinnow.io into the address of the server that holds the site. Since July 2026 that is the whole of its role: the domain now points straight at our host, so none of your page requests, form submissions or cookies pass through Cloudflare, it does not see your IP address, and it sets no cookie of any kind. What reaches Cloudflare is the query sent by your internet provider's DNS resolver, together with that resolver's own address, which is not your device. This rests on our legitimate interest in a reliably reachable domain (Art. 6(1)(f) GDPR). A data processing agreement including the EU Standard Contractual Clauses remains in place for any transfer to the United States.

Netlify (hosting & form handling):

The Platform is hosted by Netlify, Inc. (44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA). When you access the site, Netlify automatically processes server log data — including your IP address, the requested URL, date and time of access, and browser/device information — for the purpose of delivering the website and maintaining its stability and security. Netlify also processes the data you submit through our contact, application, and referral forms (Netlify Forms) in order to transmit it to us and filter spam. This is based on our legitimate interest (Art. 6(1)(f) GDPR) and, for form submissions, on the processing necessary to handle your enquiry or application. A data processing agreement including the EU Standard Contractual Clauses is in place for transfers to the United States.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

• Active profile data: Retained for the duration of your active account plus 12 months following account closure, allowing for account reactivation and dispute resolution.
• Application and placement data: Retained for 3 years following the end of an engagement to fulfil contractual and legal obligations.
• Uploaded CVs and documents: Retained with your application for 3 years following the end of an engagement, or for 12 months after we conclude that no placement will follow. You can ask us to delete an uploaded document at any time.
• Contact-form enquiries: Retained for 24 months after our last exchange with you, unless the enquiry leads to an engagement, in which case the application and placement period above applies.
• Financial and invoicing records: Retained for 7 years in accordance with applicable accounting and tax regulations.
• Usage and analytics data: Aggregated and anonymised after 24 months.
• Cookie consent records: Retained for as long as the consent is valid and for a further 3 years after it expires, is replaced, or is withdrawn, so that we can demonstrate it (Art. 7(1) GDPR).
• Communication logs: Retained for 2 years for quality assurance and dispute resolution purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised.

7. Your Rights

Under the GDPR, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at privacy@joinnow.io.

• Right of access (Art. 15 GDPR): You may request a copy of the personal data we hold about you and information about how it is processed.
• Right to rectification (Art. 16 GDPR): You may request correction of inaccurate or incomplete personal data.
• Right to erasure (Art. 17 GDPR): You may request deletion of your personal data where there is no legitimate reason for us to continue processing it.
• Right to data portability (Art. 20 GDPR): You may request that we provide your personal data in a structured, commonly used, machine-readable format for transfer to another controller.
• Right to restriction of processing (Art. 18 GDPR): You may request that we restrict processing of your data in certain circumstances.
• Right to object (Art. 21 GDPR): You may object to processing based on legitimate interests, including profiling. You may also object at any time to processing for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

We will respond to all requests within 30 days. In complex cases, this may be extended by a further 60 days, of which we will notify you. You also have the right to lodge a complaint with a data protection supervisory authority in your country of residence.

8. Contact

For all privacy-related enquiries, requests, or concerns, please contact our data protection team:

• Email: privacy@joinnow.io
• Post: JoinNow FZCO, DSO-IFZA, Dubai Silicon Oasis, Dubai, UAE

We will acknowledge receipt of your enquiry promptly and aim to resolve all matters as quickly as possible.